https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 28 Sep 2026 22:57:57 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2025-15559 <p>An unauthenticated attacker can inject OS commands when calling a server API endpoint in NesterSoft WorkTime. The server API call to generate and download the WorkTime client from the WorkTime server is vulnerable in the “guid” parameter. This allows an attacker to execute arbitrary commands on the WorkTime server as NT Authority\SYSTEM with the highest privileges. Attackers are able to access or manipulate sensitive data and take over the whole server.</p> <p>An unauthenticated attacker can inject OS commands when calling a server API endpoint in NesterSoft WorkTime. The server API call to generate and download the WorkTime client from the WorkTime server is vulnerable in the “guid” parameter. This allows an attacker to execute arbitrary commands on the WorkTime server as NT Authority\SYSTEM with the highest privileges. Attackers are able to access or manipulate sensitive data and take over the whole server.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2025-15559 https://vulnerability.circl.lu/vuln/gcve-1988-2026-0228 <p><strong>Affected:</strong> Nestersoft SEC Consult SA-20260218-0</p> <p>SEC Consult Vulnerability Lab Security Advisory &lt; 20260218-0 &gt; ======================================================================= title: Multiple Critical Vulnerabilities product: NesterSoft WorkTime (on-prem/cloud) vulnerable version: &lt;= 11.8.8 fixed version: No patch available, vendor unresponsive. CVE number: CVE-2025-15563, CVE-2025-15562, CVE-2025-15561 CVE-2025-15560, CVE-2025-15559             impact: Critical homepage:https://www.worktime.com/ found: 2025-05-22 by: Tobias Niemann (Office Bochum) Daniel Hirschberger Thorger Jansen (Office Bochum) Marius Renner (Office Berlin) SEC Consult Vulnerability Lab</p> <p>An integrated part of SEC Consult, an Atos business Europe | Asia</p> <p>https://www.sec-consult.com</p> <p>=======================================================================</p> <p>Vendor description: ------------------- &#34;WorkTime is a green employee monitoring software with a primary focus on monitoring employees&#39; productivity. It is a non-invasive, transparent, safe, and socially responsible technology. WorkTime offers a safe replacement for every invasive function.&#34;</p> <p>Source:https://www.worktime.com/employee-monitoring</p> <p>Business recommendation: ------------------------ The vendor did not respond to our communication attempts anymore. It i…</p> <p><strong>Affected:</strong> Nestersoft SEC Consult SA-20260218-0</p> <p>SEC Consult Vulnerability Lab Security Advisory &lt; 20260218-0 &gt; ======================================================================= title: Multiple Critical Vulnerabilities product: NesterSoft WorkTime (on-prem/cloud) vulnerable version: &lt;= 11.8.8 fixed version: No patch available, vendor unresponsive. CVE number: CVE-2025-15563, CVE-2025-15562, CVE-2025-15561 CVE-2025-15560, CVE-2025-15559             impact: Critical homepage:https://www.worktime.com/ found: 2025-05-22 by: Tobias Niemann (Office Bochum) Daniel Hirschberger Thorger Jansen (Office Bochum) Marius Renner (Office Berlin) SEC Consult Vulnerability Lab</p> <p>An integrated part of SEC Consult, an Atos business Europe | Asia</p> <p>https://www.sec-consult.com</p> <p>=======================================================================</p> <p>Vendor description: ------------------- &#34;WorkTime is a green employee monitoring software with a primary focus on monitoring employees&#39; productivity. It is a non-invasive, transparent, safe, and socially responsible technology. WorkTime offers a safe replacement for every invasive function.&#34;</p> <p>Source:https://www.worktime.com/employee-monitoring</p> <p>Business recommendation: ------------------------ The vendor did not respond to our communication attempts anymore. It i…</p> https://vulnerability.circl.lu/vuln/gcve-1988-2026-0228 https://vulnerability.circl.lu/vuln/ghsa-p5gf-vhgm-432f <p>An unauthenticated attacker can inject OS commands when calling a server API endpoint in NesterSoft WorkTime. The server API call to generate and download the WorkTime client from the WorkTime server is vulnerable in the “guid” parameter. This allows an attacker to execute arbitrary commands on the WorkTime server as NT Authority\SYSTEM with the highest privileges. Attackers are able to access or manipulate sensitive data and take over the whole server.</p> <p>An unauthenticated attacker can inject OS commands when calling a server API endpoint in NesterSoft WorkTime. The server API call to generate and download the WorkTime client from the WorkTime server is vulnerable in the “guid” parameter. This allows an attacker to execute arbitrary commands on the WorkTime server as NT Authority\SYSTEM with the highest privileges. Attackers are able to access or manipulate sensitive data and take over the whole server.</p> https://vulnerability.circl.lu/vuln/ghsa-p5gf-vhgm-432f